CVE-2019-13475: Mobatek Mobaxterm

High severity, CVSS 8.8. EPSS: 4.1% chance of exploitation in the next 30 days.

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.

Affected products

• Mobatek Mobaxterm: version 11.1 only

Published 2019-07-09. Last modified 2026-06-17.